CN1943203B - Method for verifying a first identity and a second identity of an entity - Google Patents

Abstract

A method for verifying a first identity and a second identity of an entity, the method comprising: receiving first identification information at a checking entity; sending second identification information from the entity to the verifying entity; verifying that the first identity and the second identity both belong to the entity; and generating a key using one of the first identification information and the second identification information.

Description

Method for verifying a first identity and a second identity of an entity

technical field

The present invention relates to verifying the identity of a network entity.

Background technique

The current move towards truly mobile computing and networking has brought about the evolution of various access technologies that also provide users with access to the Internet when they are outside their own home network. The first public communication network to provide truly ubiquitous World Wide Web (WWW) access was the GSM-based mobile telephone network.

To date, use of the Internet has been dominated by personal-to-machine communication as information services. The evolution towards so-called third generation (3G) wireless networks with consequent mobile multimedia communications will also change the way IP-based services are utilized in public mobile networks. The IP Multimedia Subsystem (IMS), as specified by the 3rd Generation Partnership Project (3GPP), combines mobile voice communications with Internet technology, allowing IP-based multimedia services to be deployed in mobile networks.

The inventors have discovered an important problem of mobile multimedia communication in the third generation wireless network, that is, the problem of identification consistency verification in the so-called third generation general authentication architecture GAA. This is described, for example, in technical specification TS 33.220v6.

New mobile terminals (multimedia phones) with multimedia functions provide application developers with an open development platform, allowing independent application developers to design new services and applications for the multimedia environment. Users can then download new applications/services to their mobile terminals and use them there.

GAA will serve as a security procedure for several future applications and services. However, the present inventors have discovered a defect in GAA.

In particular, a bootstrapping server function (BSF) is required in GAA to be able to verify the binding between the public identifier of the network application function (NAF) and the GAA internal identifier of the NAF. The public identifier of the NAF is the public hostname of the NAF used by the user equipment (UE) in the Ua interface. The internal NAF identifier is the network address used in the corresponding DIAMETER message in the Zn interface. Since the bootstrap service function uses the public NAF identifier during the derivation of the NAF private key (Ks_NAF), it is required in the bootstrap function.

This problem is even more pronounced if the NAF is doing virtual name-based hosting, that is, having multiple hostnames mapped to a single IP (Internet Protocol) address. Therefore, there may be a one-to-many mapping between internal NAF addresses and public NAF addresses. A domain name server cannot verify whether a certain NAF address identified by an internal NAF address in the bootstrap server function is authorized to use a certain public NAF address.

Embodiments of the present invention seek to address the above-mentioned problems.

Contents of the invention

According to an embodiment of the present invention, a method for verifying a first identifier and a second identifier of a network application function entity is provided, the method comprising: receiving the first network application function identifier information of the network application function entity at the verification entity ; when the verification entity receives the second network application function identifier information of the network application function entity from the network application function entity; verify the mapping between the first network application function identifier and the second network application function identifier, to verify the Whether the first network application function identifier and the second network application function identifier both belong to the network application function entity; and in response to successful verification, use one of the first network application function identifier information and the second network application function identifier information to generate key.

According to another embodiment of the present invention, a system for verifying a first identity and a second identity of a network application functional entity is provided, including: a first network application for receiving the network application functional entity at the verification entity The means for function identification is used for sending the second network application function identification of the network application function entity from the network application function entity to the means for verifying the verification entity, which is used for verifying the first network application function identification and the second network application function identification A device for mapping between function identifiers to verify whether both the first network application function identifier and the second network application function identifier belong to the network application function entity; One of the identification and the second network application function identification generates the device for the key.

According to another embodiment of the present invention, there is provided a device for verifying a first identity and a second identity of a network application functional entity, including: a first network application for receiving the network application functional entity at the verification entity The means for the function identification information is used to verify the first network application function identification and the second network application function identification information when the verification entity receives the second network application function identification information of the network application function entity from the network application function entity. mapping between function identifiers, for verifying whether the first network application function identifier and the second network application function identifier both belong to the network application function entity, and for successfully using the first network application in response to the verification A device for generating a key from one of the function identification information and the second network application function identification information.

According to an embodiment of the present invention, a device for a network application function entity is provided, where the network application function entity includes a first network application function identifier and a second network application function identifier, and the device includes: for the second means for sending the network application function identification to the verification entity, and means for receiving a key from the verification entity, wherein the key is responsive to verifying the connection between the first network application function identification and the second network application function identification. Mapping to verify that both the first network application function identifier and the second network application function identifier belong to the network application function entity, and are generated from the second network application function identifier.

Description of drawings

For a better understanding of the invention and how it may be put into practice, reference will now be made, by way of example, to the accompanying drawings, in which:

Figure 1 shows an overview of the GAA application;

Figure 2 shows a first signal flow in one embodiment of the invention; and

Fig. 3 shows a second signal flow in another embodiment of the invention.

detailed description

Referring now to FIG. 1 , there is shown a GAA architecture in which embodiments of the present invention may be incorporated.

A user equipment UE 20 is provided. The user equipment may take any suitable form, for example may be a mobile phone, personal organizer, computer or any other suitable device. The user equipment 20 is arranged to communicate with a bootstrapping server function BSF 28 via the Ub interface. The user equipment 20 is also arranged to communicate with a network application function NAF 29 via the Ua interface.

The web application function 29 can be divided into an authorization proxy function 25 and an application-specific server 26 . The web application function 29 is connected to the bootstrap server function 28 via the Zn interface.

The Bootstrap Server Function 28 is connected to the Home Subscriber System HSS 27 via the Zh interface. The bootstrap server function and the user equipment are arranged to mutually authenticate using AKA (Authentication and Key Agreement) and agree on a session key which is then applied between the user equipment and the network application function. Once the bootstrapping process has been completed, the user equipment and the NAF may run some application specific protocol, where the authentication of the messages will be based on those session keys generated during the mutual authentication between the user equipment and the bootstrap server function using the Ub interface. Generally, there will be no prior security association between user equipment and NAF. The NAF will be able to locate and securely communicate with the subscriber's bootstrap server function. The NAF shall be able to obtain the shared key material (key material) or the NAF-specific key material derived from this shared key material, which is established between the user equipment and the BSF during the bootstrapping process through the Ub interface of. NAF is set to verify the lifetime of the shared key material.

In addition to its normal functions, the HSS also stores parameters related to the bootstrap server functionality in the subscriber configuration. Optionally, parameters related to the use of some NAFs are stored in the HSS.

The interface will be described more specifically. The Ua interface carries application protocols that are secured by using or deriving keying material that is recognized between the UE and the base station functions due to running HTTP Digest AKA over the Ub interface.

The Ub interface provides mutual authentication between the user equipment and the bootstrap server function. It allows user equipment to bootstrap session keys based on the 3GPP AKA infrastructure.

The Zh interface protocol used between BSF and HSS allows BSF to read required authentication information and subscriber configuration information from HSS. The interface to the 3G authentication center is internal to the HSS.

The Zn interface is used by the NAF to read or derive keying material from the BSF that was approved during the previous HTTP Digest AKA protocol run over the Ub interface. It can also be used to read NAF specific subscriber configuration information from BSF.

Briefly, in an embodiment of the invention, the NAF 29 sends the NAF's public identifier to the bootstrap server function 28. The bootstrap server function will verify the binding between the public NAF identifier and the internal NAF identifier. The public NAF identifier is used by the BSF to derive the NAF specific key (Ks_NAF) from the master keying material (Ks) established during the bootstrapping process in the Ub interface. In particular, embodiments of the invention are applicable where the network element hosting the NAF has one or more network interfaces for servicing incoming connections from user equipment. This is the public (or external) network interface, and via the Ua interface. One network interface is used to connect to operator services such as BSF, ie the internal network interface via the Zn interface between NAF 29 and BSF 28.

The address of the internal network interface in the Zn interface is added by NAF in the DIAMETER message eg to the "Origin Host" field. Embodiments of the present invention communicate the external network interface address of the NAF, that is, the public address, from the NAF to the BSF. This can be achieved by using an AVP (Attribute Value Pair) to convey this information from NAF 29 to BSF. As mentioned earlier, the external or public address is used by the BSF since the BSF derives the NAF private key (Ks_NAF) from the fully qualified domain name (FQDN) of the NAF used by the user equipment (ie, the public address of the NAF). The BSF verifies that the NAF identified by the internal address (NAF_id_Zn) used in the Zn interface is authorized to use the external address (NAF_id_Ua) used in the Ua interface.

In an embodiment of the invention, the NAF sends NAF_Id_Ua in a first message, and receives an acknowledgment (or error) message in response. The UID may or may not be transmitted at the same time. The corresponding response may thus only concern the mapping of public and internal NAF identifiers. In an embodiment of the invention, the public NAF identifier and the internal NAF identifier are sent to the BSF, the BSF checks the mapping between them and uses the public NAF identifier to derive the NAF specific key.

Reference will now be made to Figure 2, which illustrates a first signal flow in one embodiment of the present invention. Figure 2 shows messaging details between NAF 29 and BSF 28 via the Zn interface. Before the Zn interface messaging takes place, the user equipment has requested services from the NAF through the Ua interface. With this request, the user equipment has given the TID (Transaction Identifier) and possibly the User Identifier UID. The user identifier may be communicated from the user equipment to the NAF in a subsequent message. Figure 2 describes the case where the TID and UID are sent from the user equipment to the NAF in the same message.

In step 1a, NAF 29 sends TID, NAF_id_UA and UID to BSF 28. The BSF verifies the mapping of TID to UID and the mapping of NAF_id_Zn to NAF_id_Ua. NAF_id_Ua can eg be obtained from the source host AVP. In other words, the BSF verifies that the NAF identified by the internal address is authorized to use the external address. If these verifications are successful, the BSF uses NAF_id_UA to derive Ks_NAF.

In step 2a, the BSF sends the Ks_NAF and the NAF-specific user security setting "USS" to the NAF 29 . In some embodiments of the present invention, NAF may not have USS, so USS AVP is optional. After receiving the Ks_NAF, the NAF can complete the verification process and assume the UID is correct. If no TID is found and the TID to UID or NAF_id_UA verification fails, the BSF shall return an error message to the NAF.

In case the NAF is authorized to verify the mapping of multiple TIDs to UIDs, it may send an additional request containing the TID and another UID to the BSF in step 3a. Upon receiving the TID and UID, the BSF 28 shall verify the TID-to-UID mapping and return the result to the NAF 29. This happens in step 4a. The BSF shall only perform this operation when the NAF is authorized to verify the mapping of multiple TIDs to UIDs. In this case, NAF may repeat steps 3a and 4a multiple times.

Reference will now be made to Figure 3, which illustrates the receipt of the TID and UID in separate messages. For example, TID is sent to NAF for UID.

In step 1b, the NAF 29 sends the TID and NAF_ID_Ua to the BSF. The BSF shall verify the mapping of NAF_id_Zn to NAF_id_Ua. If this verification is successful, the BSF uses NAF_id_Ua to derive Ks_NAF.

In step 2b, BSF sends Ks_NAF and NAF dedicated USS to NAF. Also, NAF can be without USS, so USS AVP is optional. After receiving Ks_NAF, NAF 29 may complete the authentication process. If no TID is found or NAF_id_Ua verification fails, BSF 28 returns an error message to NAF.

Before step 3b, the NAF has received the UID from the user equipment. In step 3b, NAF sends TID and UID for authentication. The BSF provides the result of this verification in step 4b. The procedure is the same as in messages 3a and 4a of FIG. 2 . In this case, the NAF is allowed to verify the TID to UID mapping in a separate message. The UID is not verified in steps 1b and 2b. In case the NAF is authorized to verify multiple TID to UID mappings, it may send another request to the BSF in step 5b and obtain the verification result in step 6b. These steps correspond to steps 4a and 4b of FIG. 2 . Step 5b and step 6b can be repeated multiple times. If the TID is not found in the BSF database, if the mapping of NAF_id_Ua and NAF_id_Zn cannot be verified, or if the mapping of TID and UID cannot be verified, an error message is sent from the BSF to the NAF.

Therefore, the embodiment of the present invention allows the NAF to send the NAF identifier used by the user equipment to the BSF through the UA interface, so that the BSF can derive Ks_NAF.

Claims (16)

1. A method for verifying a first identification and a second identification of a network application functional entity, the method comprising: receiving the first network application function identification information of the network application function entity at the verification entity; receiving, by the verification entity, the second network application function identification information of the network application function entity from the network application function entity; verifying the mapping between the first web application function identifier and the second web application function identifier, to verify whether both the first web application function identifier and the second web application function identifier belong to the web application function entity; and In response to successful authentication, a key is generated using one of the first web application function identification information and the second web application function identification information including a public identity, wherein the verification entity includes a bootstrapping function entity. 2. The method of claim 1, wherein said generating comprises generating said key from said second web application function identification. 3. The method of claim 1, wherein the first web application function identity comprises a public identity and the second web application function identity comprises a private identity. 4. The method of claim 1, wherein the first web application function identity comprises a private identity and the second web application function identity comprises a public identity. 5. The method according to claim 1, wherein the receiving first network application function identification information comprises receiving the first network application function identification from a user equipment. 6. A method as claimed in any one of claims 1 to 5, further comprising receiving a transaction identifier in the same message as receiving the first network application function identification. 7. A method as claimed in any one of claims 1 to 5, further comprising receiving the transaction identifier in a different message than the message receiving the first network application function identification. 8. A method as claimed in any one of claims 1 to 5, wherein the key comprises an authentication key. 9. The method of any one of claims 1 to 5, further comprising sending the key to the network application function entity. 10. The method according to any one of claims 1 to 5, wherein if said verification is unsuccessful, sending an error message to the web application functional entity is performed. 11. The method of any one of claims 1 to 5, further comprising verifying a mapping of transaction identifiers to user identifiers. 12. The method of claim 11, wherein a plurality of transaction identifiers are mapped to user identifiers, and the verification is performed for each transaction identifier to user identifier mapping in turn. 13. The method according to claim 3, wherein the public identifier is an external interface address of the network application function entity. 14. The method according to claim 4, wherein the private identifier is an internal interface address of the network application function entity. 15. A system for verifying a first identity and a second identity of a network application functional entity, comprising: means for receiving, at the verification entity, a first network application function identifier of the network application function entity, means for sending a second network application function identification of the network application function entity from the network application function entity to the verification entity, means for verifying the mapping between the first network application function identifier and the second network application function identifier to verify whether both the first network application function identifier and the second network application function identifier belong to the network application function entity, as well as Means for generating a key from one of said first and second web application function identities comprising a public identity in response to successful authentication, wherein said verification entity comprises a bootstrapping function entity. 16. A device for verifying a first identity and a second identity of a network application functional entity, comprising: means for receiving, at the verification entity, first network application function identification information of the network application function entity, means for receiving, at the verification entity, second network application function identification information of the network application function entity from the network application function entity, means for verifying the mapping between the first network application function identifier and the second network application function identifier, to verify whether the first network application function identifier and the second network application function identifier both belong to the network application function entity ,as well as Means for generating a key using one of said first web application function identification information and second web application function identification information including a public identity in response to successful authentication, wherein said verification entity comprises a bootstrapping function entity.

Images